这是indexloc提供的服务,不要输入任何密码
Skip to content

"Apply Data Archives" analyzer applies function signature to unrelated function with same name #8623

@gix

Description

@gix

Describe the bug

The "Apply Data Archives" analyzer seems to apply function signatures by name only and ignores any namespaces or name mangling. Example:

  1. Function after initial load: void ?SetBkMode@CGdiGraphicContext@@EEAAJJ@Z(longlong param_1)
  2. Function after loading PDB: long __thiscall CGdiGraphicContext::SetBkMode(CGdiGraphicContext *this,long param_1)
  3. Function after running "Apply Data Archives": int __stdcall CGdiGraphicContext::SetBkMode(HDC hdc,int mode)

The last step is wrong. The SetBkMode from the windows_vs12_64 archive is the signature for the global SetBkMode function (possibly stdcall mangled).

The example above can be observed in msftedit.dll from any Windows install.

Expected behavior
Function signatures should not be applied to unrelated functions with the same name.

Environment (please complete the following information):

  • OS: Windows 10
  • Java Version: 21
  • Ghidra Version: 11.3.2
  • Ghidra Origin: official GitHub distro

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions